<?php

declare(strict_types=1);

namespace LIT\MCP\Integrations\Divi\Pages;

use LIT\MCP\Integrations\Divi\Compose\ValueSanitizer;

defined('ABSPATH') || exit;

/**
 * WordPress sanitizing of Divi values (spec §5.6/§10). Because DiviSaver bypasses kses for the
 * page as a whole (kses would re-serialize every untouched block, D7), every value this plugin
 * writes goes through here instead – always via ValueCleaner::clean(), which also checks
 * $variable(…)$ references before and after these sanitizers.
 *
 * Rich text and code depend on unfiltered_html like in core (ruling S4): administrators keep
 * their embeds, forms and scripts; everybody else gets wp_kses_post.
 */
final class WpValueSanitizer implements ValueSanitizer
{
    public function text(string $value): string
    {
        return sanitize_text_field($value);
    }

    public function html(string $value): string
    {
        return $this->allowsUnfilteredHtml() ? $value : wp_kses_post($value);
    }

    public function code(string $value): string
    {
        return $this->allowsUnfilteredHtml() ? $value : wp_kses_post($value);
    }

    public function url(string $value): string
    {
        return esc_url_raw(trim($value));
    }

    public function allowsUnfilteredHtml(): bool
    {
        return current_user_can('unfiltered_html');
    }

    public function canReadPost(int $id): bool
    {
        return current_user_can('read_post', $id);
    }
}